Cloudfront returning 403

Dear Support and Community,

I use the following code to get a cloudfront distributed audiostream on my website. Without cookie authorization everything works fine. When I use the code on my wordpress website the cookies get set as expected but cloudfront still rejects access with a 403 error. Do you see any mistakes I could have made?

BR Iggy

<?php
/**
 * Plugin Name: CloudFront Auth Plugin 0.5
 * Description: Ein Plugin zur Implementierung der CloudFront-Cookie-Authentifizierung.
 * Version: 0.5
 * Author: us
 * License: GPL2
 */


function createSignedCookie($streamHostUrl, $resourceKey, $timeout){
    error_log('function createSignedCookie gestartet');
    $keyPairId = "APKA5**********HZVB"; // Key Pair
    $expires = time() + $timeout; // Expire Time
    $url = $streamHostUrl . '/' . $resourceKey; // Service URL -> The path for that the cookies shall be valid
    $ip=$_SERVER["REMOTE_ADDR"] . "\/24"; // IP
    $json = '{"Statement":[{"Resource":"'.$url.'","Condition":{"DateLessThan":{"AWS:EpochTime":'.$expires.'}}}]}';
    
    $private_key_path = __DIR__ . '/private_key.pem';
    $fp = fopen($private_key_path, 'r');
    if (!$fp) {
        return;
    }
    $priv_key=fread($fp, 8192);
    fclose($fp);
    
    $key = openssl_get_privatekey($priv_key);
    if(!$key){
        return;
    }
    if(!openssl_sign($json, $signed_policy, $key, OPENSSL_ALGO_SHA1)){
        error_log('Failed to sign policy: ' . openssl_error_string());
        return;
    }
    
    $base64_signed_policy = base64_encode($signed_policy);
    
    $policy = strtr(base64_encode($json), '+=/', '-_~'); //Canned Policy
    
    $signature = str_replace(array('+','=','/'), array('-','_','~'), $base64_signed_policy);
    
    $signedCookie = array(
        "CloudFront-Key-Pair-Id" => $keyPairId,
        "CloudFront-Policy" => $policy,
        "CloudFront-Signature" => $signature
    );
    return $signedCookie;
}
                                        


function TriggerSignedCookies(){

    $signedCookieCustomPolicy = createSignedCookie('cookietest.ourwebsite.com', 'music.mp3', 300);

    foreach ($signedCookieCustomPolicy as $name => $value) {
        setcookie($name, $value, 0, "/", "ourwebsite.com", true, true);
    }
}
 
function SetCloudFrontCookies() {
    global $post;
                                        
    if (is_a($post, 'WP_Post') && has_shortcode($post->post_content, 'SetCookies')) {

        TriggerSignedCookies();
    }
}

function ShortcodeHandler() {
    // Gibt einen leeren String zurück, um zu verhindern, dass "1" auf der Website angezeigt wird.
    return '';
}

function ShortcodeInit() {
    add_shortcode('SetCookies', 'ShortcodeHandler');
}

add_action('init', 'ShortcodeInit', 0);
add_action('send_headers', 'SetCloudFrontCookies', 0);
?>